IN THE CLAIMS 

1. through 6. (Canceled). 
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7. (Currently Amended) A computer-based method of providing decision support to an 
analyst in accordance with an event management system which manages a network with one or more 
computing devices, the method comprising the steps of: 

automatically analyzing, off-line, data representing past events associated with the network 
of computing devices being managed by the event management system, the automated off-line 
analysis comprising generation of one or more visualizations of one or more portions of the past 
event data and discovery of one or more patterns in the past event data; and 

automatically managing rules off-line, the automated off-line rule management comprising 
construction and validation of one or more rules formed in accordance with the automated off-line 
analysis of the past event data, wherein one or more rules are constructed offline and validated 
offline based directly on at least a portion of the one or more visualizations generated offline from 
the corresponding offline analysis of the one or more portions of the past event data and the offline 
discovery of at least a portion of the one or more patterns in the past event data; 

wherein the past event data is obtained from an event database and the one or more rules are 
provided to a rule database, the event database and the rule database being associated with an 
execution system of the event management system; 

wherein generation of the one or more visualizations of the one or more portions of the past 
event data further comprises: 

selecting a subset of the past event data from the event database; 
generating a visualization of the subset of past event data using a visualization tool; 
the analyst reviewing the visualization to determine whether there are any groupings 
of events that are of interest presented therein; and 

performing an appropriate action when an event grouping of interest is found; 

wherein discovery of the one or more patterns in the past event data further comprises: 
selecting a subset of the past event data from the event database; 
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mining the subset of the past event data to discover the one or more patterns using a 

mining tool; 

generating a visualization of the one or more patterns using a visualization tool; 
the analyst reviewing the visualization to determine whether there are any patterns of 
interest presented therein; and 

performing an appropriate action when a pattern of interest is found; 
wherein validation of the one or more rules further comprises: 

selecting a subset of the past event data from the event database; 

finding one or more instances of patterns expressed in terms of left-hand sides of 

rules; 

generating a visualization of the one or more pattern instances using a visualization 

tool; 

analyzing the left-hand sides of rules using a rule validation tool; 
displaying results of the analysis operation; 
the analyst assessing analysis results; and 

marking the rules as one of validated and not validated based on the assessment by 

the analyst; 

wherein construction of the one or more rules further comprises: 

selecting a subset of the past event data from the event database; 

mining the subset of the past event data to discover the one or more patterns using a 

mining tool; 

assessing significance of the one or more patterns using a visualization tool; 
constructing the one or more rules from a selected subset of the one or more patterns 
using a rule construction tool; and 

writing the one or more rules in the rule database . 

8. through 18. (Canceled). 
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19. (Currently Amended) An event management decision support system for providing 
decision support to an event management system which manages a network with one or more 
computing devices, the system comprising: 

an event analysis module, further comprising an event mining module and an event 
visualization module, wherein the event mining module discovers patterns in event data, and 
wherein the event visualization module provides a mechanism for visualizing at least a result of a 
pattern discovery and a rule analysis; and 

a rule management module, further comprising a rale validation module and a rule 
construction module, wherein the rule validation module maintains consistency of at least a rule with 
the event data, and wherein the rule construction module provides a mechanism for constructing one 
or more rules based on event patterns mined by the event mining module; 

wherein the one or more rules are constructed offline by the rule construction module and 
validated offline by the rule validation module based directly on at least a portion of the one or more 
visualizations generated offline by the event visualization module from the corresponding offline 
analysis of the one or more portions of the event data and the offline discovery of at least a portion 
of the one or more patterns in the event data by the event mining module; 

wherein the past event data is obtained from an event database and the one or more rules are 
provided to a rule database, the event database and the rule database being associated with an 
execution system of the event management system; 

wherein generation of the one or more visualizations of the one or more portions of the past 
event data further comprises: 

selecting a subset of the past event data from the event database; 
generating a visualization of the subset of past event data using a visualization tool; 
the analyst reviewing the visualization to determine whether there are any groupings 
of events that are of interest presented therein; and 

performing an appropriate action when an event grouping of interest is found; 

wherein discovery of the one or more patterns in the past event data further comprises: 
selecting a subset of the past event data from the event database; 
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mining the subset of the past event data to discover the one or more patterns using a 

mining tool; 

generating a visualization of the one or more patterns using a visualization tool; 
the analyst reviewing the visualization to determine whether there are any patterns of 
interest presented therein; and 

performing an appropriate action when a pattern of interest is found; 
wherein validation of the one or more rules further comprises: 

selecting a subset of the past event data from the event database; 

finding one or more instances of patterns expressed in terms of left-hand sides of 

rules; 

generating a visualization of the one or more pattern instances using a visualization 

tool; 

analyzing the left-hand sides of rules using a rule validation tool; 
displaying results of the analysis operation; 
the analyst assessing analysis results; and 

marking the rules as one of validated and not validated based on the assessment by 

the analyst; 

wherein construction of the one or more rules further comprises: 

selecting a subset of the past event data from the event database; 

mining the subset of the past event data to discover the one or more patterns using a 

mining tool; 

assessing significance of the one or more patterns using a visualization tool; 
constructing the one or more rules from a selected subset of the one or more patterns 
using a rule construction tool; and 

writing the one or more rules in the rule database . 
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